@c15t/browser 3.0.0-alpha.1 → 3.0.0-alpha.2

package/dist-types/auto-init.d.ts

@@ -1,4 +1,4 @@
-import type { ConsentClientOptions } from './types';
+import type { ConsentClientOptions } from './types.js';
 /** Attribute that turns auto-init off so the page calls `c15t.init()`. */
 export declare const MANUAL_ATTRIBUTE = "data-manual";
 /**

package/dist-types/client.d.ts

@@ -1,7 +1,7 @@
 import { custom, hosted } from '@c15t/core';
 import type { PolicyRule, Unsubscribe } from '@c15t/core';
 import type { ConsentRuntimeIABFactory } from '@c15t/core/runtime';
-import type { ConsentClient, ConsentClientOptions, ConsentUIMounter } from './types';
+import type { ConsentClient, ConsentClientOptions, ConsentUIMounter } from './types.js';
 export { custom, hosted };
 /** Attribute a page element can carry to drive the client on click. */
 export declare const ACTION_ATTRIBUTE = "data-c15t-action";

package/dist-types/devtools.d.ts

@@ -18,7 +18,7 @@
  * ```
  */
 import type { DevToolsInstance, DevToolsOptions } from '@c15t/dev-tools';
-import type { ConsentClient } from './types';
+import type { ConsentClient } from './types.js';
 /** Presentation options; the kernel and categories come from the client. */
 export type BrowserDevToolsOptions = Omit<DevToolsOptions, 'getConsentCategories' | 'kernel'>;
 /**

package/dist-types/gated-scripts.d.ts

@@ -1,4 +1,4 @@
-import type { ConsentSnapshot } from '@c15t/core';
+import type { AllConsentNames, ConsentSnapshot } from '@c15t/core';
 /** Attribute that names the category an inert `<script>` waits on. */
 export declare const CATEGORY_ATTRIBUTE = "data-c15t-category";
 /** Set once a gated script has been activated (or rejected as invalid). */
@@ -13,10 +13,11 @@ interface GatedScriptActivator {
  *
  * @param getSnapshot - Read current consent before each activation.
  * @param root - Where to look. Defaults to the document when scanning.
+ * @param registerCategories - Add discovered categories before evaluating gates.
  * @returns A scanner and its disposal function.
  * @internal
  */
-export declare const createGatedScriptActivator: (getSnapshot: () => ConsentSnapshot, root?: ParentNode) => GatedScriptActivator;
+export declare const createGatedScriptActivator: (getSnapshot: () => ConsentSnapshot, root?: ParentNode, registerCategories?: (categories: AllConsentNames[]) => void) => GatedScriptActivator;
 /**
  * Run inert `<script type="text/plain" data-c15t-category="…">` tags whose
  * categories the snapshot grants. Non-async scripts run in document order,

package/dist-types/global.d.ts

@@ -1,10 +1,10 @@
 import { custom, hosted } from '@c15t/core';
 import type { AllConsentNames, ConsentSnapshot, HasCondition, KernelUser, Unsubscribe } from '@c15t/core';
 import type { DevToolsInstance } from '@c15t/dev-tools';
-import type { CreateConsentClientContext } from './client';
-import { manifest } from './transports/manifest';
-import { offline } from './transports/offline';
-import type { ConsentClient, ConsentClientEventMap, ConsentClientOptions, ConsentUIHandle, ConsentUIOptions } from './types';
+import type { CreateConsentClientContext } from './client.js';
+import { manifest } from './transports/manifest.js';
+import { offline } from './transports/offline.js';
+import type { ConsentClient, ConsentClientEventMap, ConsentClientOptions, ConsentUIHandle, ConsentUIOptions } from './types.js';
 /** The name the script-tag build installs itself under. */
 export declare const GLOBAL_NAME = "c15t";
 /** A call queued before the script loaded: `[method, ...args]`. */

package/dist-types/headless.d.ts

@@ -13,7 +13,7 @@
  * c15t.on('ui', (surface) => banner.hidden = surface !== 'banner');
  * ```
  */
-import type { ConsentClient, ConsentClientOptions } from './types';
+import type { ConsentClient, ConsentClientOptions } from './types.js';
 /**
  * Create the page's client without starting it. `mountUI()` throws.
  *
@@ -28,14 +28,14 @@ export declare const createConsentClient: (options?: ConsentClientOptions) => Co
  * @returns The started client.
  */
 export declare const init: (options?: ConsentClientOptions) => ConsentClient;
-export { ACTION_ATTRIBUTE, custom, hosted, PREFERENCES_HASH } from './client';
-export type { PageAction } from './client';
-export { resolveRules } from './client';
-export { ACTIVATED_ATTRIBUTE, activateGatedScripts, CATEGORY_ATTRIBUTE, } from './gated-scripts';
-export { manifest, manifestNeedsLocation } from './transports/manifest';
-export type { ManifestModeOptions } from './transports/manifest';
-export { offline } from './transports/offline';
-export type { OfflineModeOptions } from './transports/offline';
-export type { ConsentClient, ConsentClientEventMap, ConsentClientOptions, ConsentModeName, PolicyPresetName, } from './types';
-export { version } from './version';
+export { ACTION_ATTRIBUTE, custom, hosted, PREFERENCES_HASH } from './client.js';
+export type { PageAction } from './client.js';
+export { resolveRules } from './client.js';
+export { ACTIVATED_ATTRIBUTE, activateGatedScripts, CATEGORY_ATTRIBUTE, } from './gated-scripts.js';
+export { manifest, manifestNeedsLocation } from './transports/manifest.js';
+export type { ManifestModeOptions } from './transports/manifest.js';
+export { offline } from './transports/offline.js';
+export type { OfflineModeOptions } from './transports/offline.js';
+export type { ConsentClient, ConsentClientEventMap, ConsentClientOptions, ConsentModeName, PolicyPresetName, } from './types.js';
+export { version } from './version.js';
 export type { ConsentSnapshot, ConsentState } from '@c15t/core';

package/dist-types/iab/mount.d.ts

@@ -1,4 +1,4 @@
-import type { ConsentClient, ConsentUIHandle, ConsentUIOptions } from '../types';
+import type { ConsentClient, ConsentUIHandle, ConsentUIOptions } from '../types.js';
 /**
  * Mount IAB UI alongside the ordinary UI for non-IAB policy regions.
  * @param client - The IAB-capable client to render.

package/dist-types/iab/preferences.d.ts

@@ -1,5 +1,5 @@
 import type { ConsentSnapshot } from '@c15t/core';
-import type { SurfaceContext } from '../ui/surface';
+import type { SurfaceContext } from '../ui/surface.js';
 /** Preference content preserves focused controls while the IAB draft changes. */
 export interface IABPreferences {
     element: HTMLElement;

package/dist-types/iab/surface.d.ts

@@ -1,4 +1,4 @@
-import type { ConsentUIOptions } from '../types';
-import type { Surface, SurfaceContext } from '../ui/surface';
+import type { ConsentUIOptions } from '../types.js';
+import type { Surface, SurfaceContext } from '../ui/surface.js';
 /** One IAB banner/dialog lifecycle on the client's existing kernel. */
 export declare const createIABSurface: (ctx: SurfaceContext, options: ConsentUIOptions) => Surface;

package/dist-types/iab/vendor-disclosures.d.ts

@@ -1,5 +1,5 @@
 import type { ConsentSnapshot, GlobalVendorList, NonIABVendor } from '@c15t/core';
-import type { SurfaceCopy } from '../ui/copy';
+import type { SurfaceCopy } from '../ui/copy.js';
 type Vendor = GlobalVendorList['vendors'][number] | NonIABVendor;
 /**
  * Render the vendor's declared policies, data use, storage, and retention.

package/dist-types/iab.d.ts

@@ -1,4 +1,4 @@
-import type { ConsentClient, ConsentClientOptions } from './types';
+import type { ConsentClient, ConsentClientOptions } from './types.js';
 /**
  * Create an IAB-capable browser client without starting it.
  * @param options - Transport, CMP, and presentation settings.
@@ -11,10 +11,10 @@ export declare const createConsentClient: (options?: ConsentClientOptions) => Co
  * @returns The started client. CMP controls are on `client.runtime.iab`.
  */
 export declare const init: (options?: ConsentClientOptions) => ConsentClient;
-export { custom, hosted } from './client';
-export { offline } from './transports/offline';
-export { manifest } from './transports/manifest';
-export { mountIABConsentUI } from './iab/mount';
-export type { ConsentClient, ConsentClientOptions, ConsentUIOptions, } from './types';
+export { custom, hosted } from './client.js';
+export { offline } from './transports/offline.js';
+export { manifest } from './transports/manifest.js';
+export { mountIABConsentUI } from './iab/mount.js';
+export type { ConsentClient, ConsentClientOptions, ConsentUIOptions, } from './types.js';
 export { iab } from '@c15t/iab';
-export { version } from './version';
+export { version } from './version.js';

package/dist-types/index.d.ts

@@ -14,7 +14,7 @@
  * c15t.on('consent', (snapshot) => console.log(snapshot.effectivePermissions));
  * ```
  */
-import type { ConsentClient, ConsentClientOptions } from './types';
+import type { ConsentClient, ConsentClientOptions } from './types.js';
 /**
  * Create the page's client without starting it.
  *
@@ -29,15 +29,15 @@ export declare const createConsentClient: (options?: ConsentClientOptions) => Co
  * @returns The started client.
  */
 export declare const init: (options?: ConsentClientOptions) => ConsentClient;
-export { ACTION_ATTRIBUTE, custom, hosted, PREFERENCES_HASH } from './client';
-export type { PageAction } from './client';
-export { resolveRules } from './client';
-export { ACTIVATED_ATTRIBUTE, activateGatedScripts, CATEGORY_ATTRIBUTE, } from './gated-scripts';
-export { manifest, manifestNeedsLocation } from './transports/manifest';
-export type { ManifestModeOptions } from './transports/manifest';
-export { offline } from './transports/offline';
-export type { OfflineModeOptions } from './transports/offline';
-export type { ConsentBannerOptions, ConsentClient, ConsentClientEventMap, ConsentClientOptions, ConsentDialogOptions, ConsentModeName, PolicyPresetName, ConsentTriggerOptions, ConsentUIHandle, ConsentUIOptions, TriggerPosition, } from './types';
-export { mountConsentUI } from './ui/mount';
-export { version } from './version';
+export { ACTION_ATTRIBUTE, custom, hosted, PREFERENCES_HASH } from './client.js';
+export type { PageAction } from './client.js';
+export { resolveRules } from './client.js';
+export { ACTIVATED_ATTRIBUTE, activateGatedScripts, CATEGORY_ATTRIBUTE, } from './gated-scripts.js';
+export { manifest, manifestNeedsLocation } from './transports/manifest.js';
+export type { ManifestModeOptions } from './transports/manifest.js';
+export { offline } from './transports/offline.js';
+export type { OfflineModeOptions } from './transports/offline.js';
+export type { ConsentBannerOptions, ConsentClient, ConsentClientEventMap, ConsentClientOptions, ConsentDialogOptions, ConsentModeName, PolicyPresetName, ConsentTriggerOptions, ConsentUIHandle, ConsentUIOptions, TriggerPosition, } from './types.js';
+export { mountConsentUI } from './ui/mount.js';
+export { version } from './version.js';
 export type { ConsentSnapshot, ConsentState } from '@c15t/core';

package/dist-types/ui/banner.d.ts

@@ -1,5 +1,5 @@
-import type { ConsentBannerOptions } from '../types';
-import type { Surface, SurfaceContext } from './surface';
+import type { ConsentBannerOptions } from '../types.js';
+import type { Surface, SurfaceContext } from './surface.js';
 /**
  * The cookie banner.
  *

package/dist-types/ui/dialog.d.ts

@@ -1,5 +1,5 @@
-import type { ConsentDialogOptions } from '../types';
-import type { Surface, SurfaceContext } from './surface';
+import type { ConsentDialogOptions } from '../types.js';
+import type { Surface, SurfaceContext } from './surface.js';
 /**
  * The preference centre dialog.
  *

package/dist-types/ui/mount.d.ts

@@ -1,5 +1,5 @@
-import type { ConsentClient, ConsentUIHandle, ConsentUIOptions } from '../types';
-import type { Surface, SurfaceContext } from './surface';
+import type { ConsentClient, ConsentUIHandle, ConsentUIOptions } from '../types.js';
+import type { Surface, SurfaceContext } from './surface.js';
 /**
  * Mount the banner, preference centre and trigger for a client.
  *

package/dist-types/ui/surface.d.ts

@@ -1,6 +1,6 @@
 import type { ConsentSnapshot, LegalLinks } from '@c15t/core';
 import type { LegalLinksTranslations } from '@c15t/translations';
-import type { ConsentClient } from '../types';
+import type { ConsentClient } from '../types.js';
 /** What every surface renders against. */
 export interface SurfaceContext {
     /** The client whose kernel drives the surface. */

package/dist-types/ui/trigger.d.ts

@@ -1,5 +1,5 @@
-import type { ConsentTriggerOptions } from '../types';
-import type { Surface, SurfaceContext } from './surface';
+import type { ConsentTriggerOptions } from '../types.js';
+import type { Surface, SurfaceContext } from './surface.js';
 /**
  * The floating button that reopens the preference centre.
  *

package/dist-types/ui/widget.d.ts

@@ -1,5 +1,5 @@
 import type { ConsentSnapshot } from '@c15t/core';
-import type { SurfaceContext } from './surface';
+import type { SurfaceContext } from './surface.js';
 /** The preference list plus its footer. */
 export interface Widget {
     /** The widget root. */

package/dist-types/version.d.ts

@@ -1 +1 @@
-export declare const version = "3.0.0-alpha.1";
+export declare const version = "3.0.0-alpha.2";

package/docs/README.md

@@ -30,12 +30,14 @@ These docs describe v3. Start with Inth hosted setup, identify the framework, ro
 - [Clear on revocation](./integrations/clear-on-revocation.md): Remove configured first-party cookies and Web Storage keys when their consent category is denied.
 - [Clearbit](./integrations/clearbit.md): Configure Clearbit with c15t v3, understand marketing permission and verify loading and revocation.
 - [Cloudflare Web Analytics](./integrations/cloudflare-web-analytics.md): Configure Cloudflare Web Analytics with c15t v3, understand measurement permission and verify loading and revocation.
+- [Cloudflare Zaraz](./integrations/cloudflare-zaraz.md): Synchronize c15t permissions with Zaraz purposes while Cloudflare manages your tools.
 - [Crisp](./integrations/crisp.md): Configure Crisp with c15t v3, understand functionality permission and verify loading and revocation.
 - [Databuddy](./integrations/databuddy.md): Configure Databuddy's initial and updated consent state with c15t v3.
 - [Fathom Analytics](./integrations/fathom-analytics.md): Configure Fathom Analytics with c15t v3, understand measurement permission and verify loading and revocation.
 - [Google Maps](./integrations/google-maps.md): Prevent a map iframe from mounting before the required permission.
 - [Google Tag](./integrations/google-tag.md): Configure gtag with c15t Consent Mode signals and understand its loading behavior.
 - [Google Tag Manager](./integrations/google-tag-manager.md): Load GTM with c15t consent signals and verify the tags inside your container.
+- [Granular consent](./integrations/granular-consent.md): Let visitors grant a category and still turn one vendor off, without adopting IAB TCF.
 - [Heap](./integrations/heap.md): Configure Heap with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hightouch](./integrations/hightouch.md): Configure Hightouch with c15t v3, understand measurement permission and verify loading and revocation.
 - [Hotjar](./integrations/hotjar.md): Configure Hotjar with c15t v3, understand measurement permission and verify loading and revocation.

package/docs/frameworks/javascript/script-loader.md

@@ -46,6 +46,46 @@ The loader exposes `updateScripts`, `getLoadedScriptIds` and `dispose`.
 Unloading an element cannot reverse requests or code that already ran. Test
 revocation and vendor cleanup with [verification](https://c15t.com/docs/guides/verify-consent).
 
+## Dispose integration resources
+
+Ordinary scripts keep their mounted resource when `updateScripts` receives a
+fresh object with the same ID and unchanged element configuration. New callback
+functions alone do not reload the vendor or send a temporary denial. Changing
+the source, inline code or element attributes starts a new loading lifecycle.
+Consent conditions are reevaluated on every configuration update. Pending
+load and error events use the latest registered callbacks and consent state.
+Setting `persistAfterConsentRevoked` to `false` removes an owned retained element
+when the script no longer has consent.
+
+Custom script configurations can use `onDispose(info)` to release event
+listeners or other resources. Adding this hook opts the configuration into an
+object-owned lifecycle: replacing the object disposes its resources and starts
+again, even with the same ID. Keep these objects stable across framework
+rerenders. The loader also calls the hook when the configuration is removed or
+the loader is disposed, including configurations that never loaded.
+`info.element` contains the last loaded or retained element when available,
+even when configuration removal has already detached it.
+
+Duplicate references receive one cleanup per registration. Re-registering a
+removed object starts a new lifecycle. Updates requested from lifecycle
+callbacks run after the current pass; if several are requested, the latest
+configuration wins. Disposal stops further reconciliation. A callback feedback
+loop exceeding 100 consecutive passes disposes the loader and reports an
+`error` debug event. Avoid callbacks that keep changing consent or replacing
+their own configuration.
+
+`onBeforeLoad` prepares a loading attempt. If a callback changes consent or
+replaces configurations, the loader cancels that attempt before loading and
+reevaluates the latest state. A still-eligible script can retry preparation
+with a new element and updated consent. Make `onBeforeLoad` safe to repeat;
+use `onLoad` for initialization that requires a completed load. This also
+applies to callback-only scripts, whose `onLoad` is skipped when preparation
+invalidates the current pass.
+
+Consent revocation alone does not call `onDispose`. Use `onConsentChange` for
+vendor opt-out commands. Cleanup errors are reported through the loader's debug
+events and do not prevent other configurations from being cleaned up.
+
 ## Clear stored tracking data
 
 Script gating does not remove cookies or Web Storage entries that a script

package/docs/integrations/building-integrations.md

@@ -31,6 +31,11 @@ Replace the example URL and implement the vendor's initialization. This is a
 loader template, not a functioning analytics SDK. The script stays blocked
 while measurement permission is denied.
 
+Add `vendor: 'example-analytics'` and declare the vendor in the runtime's
+`vendors` option or in the backend manifest when visitors should be able to
+turn this vendor off inside a granted category. See
+[granular consent](./granular-consent.md).
+
 ## Define revocation deliberately
 
 `onConsentChange` receives current permission information. Use it to update the